Designing and Developing Scalable IP Networks Guy Davies Telindus, UK John Wiley & Sons, Ltd
Contents List of Figures List of Tables About the Author Acknowledgements Abbreviations Introduction xi xiii xv xvii xix xxv 1 Hardware Design 1 1.1 Separation of Routing and Forwarding Functionality 2 1.2 Building Blocks 2 1.2.1 Control Module 3 1.2.2 Forwarding Module 3 1.2.3 Non-Stop Forwarding 3 1.2.4 Stateful Failover 3 1.3 To Flow or Not to Flow? 4 1.4 Hardware Redundancy, Single Chassis or Multi Chassis 5 2 Transport Media 7 2.1 Maximum Transmission Unit (MTU) 7 2.1.1 Path MTU Discovery 8 2.1.2 Port Density 8 2.1.3 Channelized Interfaces 9
vi CONTENTS 2.2 Ethernet 9 2.2.1 Address Resolution Protocol (ARP) 10 2.2.2 MTU 11 2.3 Asynchronous Transfer Mode (ATM) 11 2.4 Packet Over SONET (POS) 13 2.5 SRP/RPR and DPT 13 2.5.1 Intelligent Protection Switching 15 2.6 (Fractional) E1/T1/E3/T3 16 2.7 Wireless Transport 17 2.7.1 Regulatory Constraints 17 2.7.2 Interference 17 2.7.3 Obstructions 17 2.7.4 Atmospheric Conditions 18 2.7.5 If it is so bad... 18 3 Router and Network Management 21 3.1 The Importance of an Out-Of-Band (OOB) Network 21 3.1.1 Management Ethernet 22 3.1.2 Console Port 22 3.1.3 Auxiliary (Aux) Port 22 3.1.4 Remote Power Management 23 3.1.5 Uninterruptible Power Supplies (UPS) 23 3.2 Network Time Protocol (NTP) 23 3.3 Logging 24 3.4 Simple Network Management Protocol (SNMP) 24 3.4.1 SNMPvl, v2c and v3 25 3.5 Remote Monitoring (RMON) 26 3.6 Network Management Systems 26 3.6.1 CiscoWorks 26 3.6.2 JUNOScope 27 3.6.3 Non-Proprietary Systems 27 3.7 Configuration Management 27 3.7.1 Concurrent Version System (CVS) 27 3.7.2 Scripting and Other Automated Configuration Distribution and Storage Mechanisms 28 3.8 To Upgrade or Not to Upgrade 31 3.8.1 Software Release Cycles 32 3.9 Capacity Planning Techniques 32 4 Network Security 35 4.1 Securing Access to Your Network Devices 35 4.1.1 Physical Security 36 4.1.2 Authentication, Authorization and Accounting (AAA) 36
CONTENTS vii 4.2 Securing Access to the Network Infrastructure 40 4.2.1 Authentication of Users, Hosts and Servers 40 4.2.2 Encryption of Information 40 4.2.3 Access Tools and Protocols 41 4.2.4 IP Security (IPsec) 43 4.2.5 Access Control Lists 44 4.2.6 RFC 1918 Addresses 45 4.2.7 Preventing and Tracing Denial of Service (DoS) Attacks 46 4.3 Protecting Your Own and Others' Network Devices 47 5 Routing Protocols 49 5.1 Why Different Routing Protocols? 50 5.2 Interior Gateway Protocols (IGP) 50 5.2.1 Open Shortest Path First (OSPF) 51 5.2.2 Authentication of OSPF 53 5.2.3 Stub Areas, Not So Stubby Areas (NSSA) and Totally Stubby Areas 54 5.2.4 OSPF Graceful Restart 55 5.2.5 OSPFv3 56 5.2.6 Intermediate System to Intermediate System (IS-IS) 56 5.2.7 Authentication of IS-IS 57 5.2.8 IS-IS Graceful Restart " 58 5.2.9 Routing Information Protocol (RIP) 58 5.2.10 Interior Gateway Routing Protocol (IGRP) and Enhanced Interior Gateway Routing Protocol (EIGRP) 59 5.2.11 Diffusing Update Algorithm (DUAL) 61 5.2.12 Stuck-in-Active 62 5.2.13 Why use EIGRP? 62 5.3 Exterior Protocols 63 5.3.1 Border Gateway Protocol (BGP) 63 5.3.2 Authentication of BGP 67 5.3.3 BGP Graceful Restart 68 5.3.4 Multiprotocol BGP 69 6 Routing Policy 71 6.1 What is Policy For? 71 6.1.1 Who Pays Whom? 72 6.2 Implementing Scalable Routing Policies 72 6.3 How is Policy Evaluated? 73 6.3.1 AND or OR? 73 6.3.2 The Flow of Policy Evaluation 73 6.4 Policy Matches 74 6.5 Policy Actions 74
viii CONTENTS 6.5.1 The Default Action 74 6.5.2 Accept/Permit, Reject/Deny, and Discard 74 6.6 Policy Elements 75 6.7 AS Paths 75 6.8 Prefix Lists and Route Lists 75 6.9 Internet Routing Registries 77 6.10 Communities 78 6.11 Multi-Exit Discriminator (MED) 80 6.12 Local Preference 80 6.13 Damping 81 6.14 Unicast Reverse Path Forwarding 83 6.15 Policy Routing/Filter-Based Forwarding 84 6.16 Policy Recommendations 84 6.16.1 Policy Recommendations for Customer Connections 84 6.16.2 Policy Recommendations for Peering Connections 85 6.16.3 Policy Recommendations for Transit Connections 85 6.17 Side Effects of Policy 91 7 Multiprotocol Label Switching (MPLS) 97 7.1 Traffic Engineering 98 7.2 Label Distribution Protocols 99 7.3 Tag Distribution Protocol (TDP) 100 7.4 Label Distribution Protocol (LDP) 100 7.4.1 LDP Graceful Restart 101 7.5 RSVP with Traffic Engineering Extensions (RSVP-TE) 101 7.5.1 RSVP-TE Graceful Restart 102 7.5.2 OSPF with Traffic Engineering Extensions (OSPF-TE) 102 7.5.3 IS-IS with Traffic Engineering Extensions (IS-IS-TE) 102 7.6 Fast Reroute 103 7.7 Integrating ATM and IP Networks 104 7.8 Generalized MPLS (GMPLS) 105 8 Virtual Private Networks (VPNs) 109 8.1 VPNs at Layer 3 109 8.1.1 Layer 3 VPN (RFC 2547bis) 109 8.1.2 Generic Router Encapsulation (GRE) 111 8.1.3 IPsec 112 8.2 VPNs at Layer 2 112 8.2.1 Circuit Cross-Connect (CCC) 112 8.2.2 Translational Cross-Connect (TCC) 113 8.2.3 Martini (Layer 2 circuits) 113 8.2.4 Virtual Private Wire Service (VPWS) 114 8.2.5 Virtual Private LAN Service (VPLS) 116 8.2.6 Layer 2 Tunnelling Protocol (L2TP) 117
CONTENTS ix 9 Class of Service and Quality of Service 9.1 Design and Architectural Issues of CoS/QoS 9.2 CoS/QoS Functional Elements 9.2.1 Classification 9.2.2 Congestion Notification Mechanisms 9.2.3 Congestion Avoidance Mechanisms 9.2.4 Queueing Strategies 9.3 QoS Marking Mechanisms 9.3.1 Layer 2 Marking 9.3.2 Layer 3 QoS 9.3.3 MPLS EXP 9.4 Integrating QoS at Layer 2, in IP and in MPLS 9.4.1 DiffServ Integration with MPLS 119 119 120 120 121 122 124 127 128 129 130 130 131 10 Multicast 10.1 Multicast Forwarding at Layer 2 10.1.1 Multicast on Ethernet and FDDI 10.1.2 Multicast Over Token Ring 10.1.3 Internet Group Management Protocol (IGMP) 10.1.4 IGMP Snooping 10.1.5 PIM/DVMRP Snooping 10.1.6 Immediate Leave Processing 10.1.7 Cisco Group Management Protocol (CGMP) 10.2 Multicast Routing 10.2.1 Reverse Path Forwarding (RPF) Check 10.2.2 Dense Mode Protocols 10.2.3 Sparse Mode Protocols 10.2.4 Multicast Source Discovery Protocol (MSDP) 10.2.5 Multiprotocol BGP 10.2.6 Multicast Scoping 133 133 134 134 135 136 136 137 137 138 138 138 143 148 149 149 11 IPv6 11.1 Evolution and Revolution 11.2 IPv6 Headers 11.3 IPv6 Addressing 11.3.1 Hierarchical Allocations 11.3.2 Address Classes 11.4 Stateless Autoconfiguration 11.5 Domain Name System (DNS) 11.6 Transition Mechanisms 11.6.1 Dual Stack 11.6.2 Network Address Translation Protocol Translation 11.6.3 Tunnelling IPv6 in IPv4 153 153 154 154 155 157 158 158 159 159 159 160
CONTENTS 11.7 Routing in IPv6 161 11.7.1 IS-IS for IPv6 161 11.7.2 OSPFv3 161 11.7.3 RIPng 161 11.7.4 Multiprotocol BGP 162 11.8 Multicast in IPv6 162 11.9 IPv6 Security 162 11.10 Mobility in IPv6 163 12 Complete Example Configuration Files (IOS and JUNOS Software) 165 12.1 Core Router (P) Running MPLS TE Supporting LDP Tunnelled Through RSVP-TE, No Edge Interfaces, ibgp Only, Multicast RP (Anycast Static) MSDP, PIM-SM (JUNOS) 166 12.2 Core Router (P) Running MPLS TE Supporting LDP Tunnelled Through RSVP-TE, No Edge Interfaces, ibgp Only, Multicast RP (Anycast Static) MSDP, PIM-SM (IOS) 183 12.3 Aggregation Router (PE) Running MPLS L3 and L2VPN Over LDP, BGP Policy to Customers, MBGP, PIM-SM (JUNOS) 192 12.4 Aggregation Router (PE) Running MPLS L3 and L2VPN Over LDP, BGP Policy to Customers, MBGP, PIM-SM (IOS) 213 12.5 Border Router Running MPLS with LDP, BGP Policy to Peers, MBGP, PIM-SM (JUNOS) 222 12.6 Border Router Running MPLS with LDP, BGP Policy to Peers, MBGP, PIM-SM (IOS) 236 12.7 Transit Router Running MPLS with LDP, BGP Policy to Upstream Transit Providers, MBGP, PIM-SM (JUNOS) 242 12.8 Transit Router Running MPLS with LDP, BGP Policy to Upstream Transit Providers, MBGP, PIM-SM (IOS) 257 References 263 Index 265